ISO 22000:2018 — Food Safety Management System

ISO 22000:2018 is an international standard that specifies the requirements for food safety management systems. It helps organisations throughout the food chain identify, assess, and control hazards that could compromise food safety.

Introduction

The ISO 22000:2018 standard specifies the requirements for a Food Safety Management System (FSMS). It applies to organisations operating at different stages of the food chain, including primary producers, manufacturers, transporters, storage providers, distributors, and catering businesses.

Published in June 2018, this edition incorporates the principles of the HACCP system (Hazard Analysis and Critical Control Points), established by the Codex Alimentarius, into a structured management approach. It combines communication between stakeholders, management of the system, prerequisite programmes, and hazard analysis.

The standard was also subject to a 2024 amendment concerning the consideration of climate change in management system standards. Organisations implementing or seeking certification against ISO 22000 should therefore consult the applicable edition and its amendments.

1. Harmonised Structure: Alignment with Other ISO Standards

ISO 22000:2018 adopts the harmonised structure shared by ISO management system standards, previously known as the High-Level Structure (HLS). This common structure facilitates integration with other management systems, particularly:

• ISO 9001: Quality management;
• ISO 14001: Environmental management;
• ISO 45001: Occupational health and safety management.

The structure consists of ten clauses:

1. Scope;
2. Normative references;
3. Terms and definitions;
4. Context of the organisation;
5. Leadership;
6. Planning;
7. Support;
8. Operation;
9. Performance evaluation;
10. Improvement.

This common structure facilitates coordination of processes, responsibilities, audits, and improvement actions. A food business can therefore integrate food safety into a broader management system while retaining the specific requirements of each discipline.

2. The Four Fundamental Elements of ISO 22000

ISO 22000 is based on four complementary elements that contribute to controlling food safety hazards.

2.1. Interactive Communication

Food safety requires effective communication throughout the food chain.

This includes communication with:

• Suppliers and producers;
• Different departments within the organisation;
• Transporters and distributors;
• Customers and, where relevant, consumers;
• Competent authorities.

This communication ensures that relevant information about identified hazards, storage conditions, applicable requirements, and control measures is transmitted effectively. It also supports coordinated responses to non-conformities and product withdrawals.

2.2. System Management

The standard adopts a systematic approach based on processes, risk analysis, and continual improvement.

Top management must demonstrate commitment, establish a food safety policy, assign responsibilities, and provide the resources necessary to operate the system.

The approach is supported by the PDCA cycle (Plan-Do-Check-Act), which involves planning actions, implementing them, evaluating results, and making the necessary improvements.

2.3. Prerequisite Programmes (PRPs)

Prerequisite programmes establish the basic hygiene and operational conditions needed to maintain an environment suitable for producing and handling food.

They may cover:

• Premises design and maintenance;
• Cleaning and disinfection;
• Personnel hygiene;
• Pest control;
• Water and air quality;
• Waste management;
• Equipment maintenance;
• Prevention of cross-contamination;
• Transport and storage.

Prerequisite programmes must be adapted to the organisation’s activities and associated hazards. The ISO 22002 series provides additional specifications for different sectors. Its structure was updated in 2025, including ISO 22002-100:2025 for common requirements and sector-specific parts such as ISO 22002-1:2025 for food manufacturing and ISO 22002-5:2025 for transport and storage.

The applicable documents should be selected according to the organisation’s actual activities and the requirements of its management system.

2.4. HACCP Principles

The HACCP approach identifies biological, chemical, and physical hazards that could compromise food safety and determines appropriate control measures.

It includes:

• Conducting a hazard analysis;
• Identifying Critical Control Points (CCPs), where necessary;
• Establishing critical limits for CCPs;
• Implementing monitoring procedures;
• Defining corrective actions;
• Verifying the effectiveness of control measures;
• Maintaining the necessary documents and records.

Not every hazard necessarily leads to a CCP. The classification of control measures must result from the hazard analysis and the method adopted by the organisation in accordance with the applicable requirements.

3. Benefits of ISO 22000

Implementing an ISO 22000-compliant system can provide several benefits.

• Improved control of food safety hazards: Structured identification of hazards and implementation of appropriate preventive measures.
• Better organisation: Clearer responsibilities, processes, and controls.
• Support for regulatory compliance: Better identification and consideration of applicable legal obligations, without replacing regulatory inspections.
• Increased customer confidence: Demonstration of a structured approach to food safety management.
• Incident management: Improved traceability and the ability to manage non-conformities, product withdrawals, and recalls.
• Continual improvement: Performance monitoring, corrective action, and review of control measures.

Certification can strengthen an organisation’s credibility with certain customers and business partners. However, it does not guarantee the complete absence of risk and does not replace legal obligations or official controls.

Third-party certification is not required by the standard itself. It may nevertheless be requested by particular customers, contracting organisations, or markets.

4. Application in Morocco

In Morocco, food businesses must comply with the legal and regulatory requirements applicable to food safety.

Law No. 28-07 on the safety of food products, promulgated by Dahir No. 1-10-08 of 11 February 2010, is a major reference within the national regulatory framework. Its implementation is notably specified by Decree No. 2-10-473 of 6 September 2011.

Depending on the activity and type of establishment, requirements for sanitary authorisation or approval by the National Office for Food Safety (ONSSA) may also apply.

ISO 22000 can help a business structure its food safety practices and improve control over its processes. However, it does not replace authorisations, approvals, inspections, or other obligations imposed by Moroccan law.

Businesses placing products on the European Union market must also comply with the applicable European requirements. Regulation (EC) No. 852/2004 on the hygiene of foodstuffs is an important reference for the operators concerned. The scope of these obligations depends on the activity and the rules applicable to the products being marketed.

IICP HSE Academy can support Moroccan businesses in understanding ISO 22000 requirements, training staff, preparing documentation, and establishing a structured food safety management approach.

5. Recommended Steps for Implementing ISO 22000

Implementation can be organised into several stages:

1. Analyse the organisation’s context: Activities, products, processes, interested parties, and applicable requirements.
2. Assess existing practices: Identify gaps between current operations and the standard’s requirements.
3. Establish prerequisite programmes appropriate to the sector and facilities.
4. Appoint the food safety team and define responsibilities.
5. Describe products and processes, then conduct the hazard analysis.
6. Determine and implement control measures, including CCPs where necessary.
7. Establish the procedures and records required for the system to operate effectively.
8. Train and raise staff awareness according to their responsibilities.
9. Verify system performance through inspections, evaluations, and internal audits.
10. Address non-conformities and improve the system before pursuing certification, if desired, through a competent certification body.

The implementation approach should be proportionate to the size of the business, the complexity of its operations, and the hazards associated with its products.

Conclusion

ISO 22000:2018 provides a structured framework for managing food safety throughout the relevant stages of the food chain. By combining communication, system management, prerequisite programmes, and HACCP principles, it helps organisations prevent hazards and improve control over their processes.

In Morocco, implementation must be aligned with Law No. 28-07, its implementing regulations, and the ONSSA requirements applicable to the organisation’s activities. An effective approach relies on risk analysis, management commitment, staff training, and continual improvement.

Sources and References

1. ISO — ISO 22000:2018: Food Safety Management Systems.
   https://www.iso.org/standard/65464.html

2. ISO — ISO 22002 Series: Prerequisite Programmes for Food Safety.
   https://www.iso.org/standard/22002-1

3. ONSSA — Moroccan Regulations on Food Safety.
   https://www.onssa.gov.ma/reglementation/reglementation-transversale/securite-sanitaire/